Cortex XDR Discussions

Process Explorer Triggering Cortex XDR Alert – Clarification Needed

Hi,

When our system administration team uses Process Explorer (Microsoft version), Cortex XDR  does not block the execution, but it generates alerts/incidents.

Alert Details:

• Alert Name: Impair Defenses - 3645069560

• Description: A tampering-capable

XDR 7.6.1 seems to ignore exception

Hi, Cortex XDR Local Analysis Malware module stops a process called "ClientConsole.exe" (I guess it's a false positive)

I've created a global exception for that issue and checked-in client but XDR still blocks this executable.

In client log I read th

[Cortex] How to Block Multiple C2 IP Addresses Using Cortex XDR

Dear Everyone,

My customer has a requirement: they would like the Cortex XDR Agent to detect and block multiple specified C2 IP addresses.
I would like to ask if anyone has encountered a similar case or has any relevant experience to share.

Currently,

Cortex xdr agent distributed network scan

Hi Team,

We have enabled the Cortex XDR agent's distributed network scan, and we are getting successful results in the XDR Management Console. Our question is: Which port is used by the XDR agent to identify unmanaged assets

bulk broker vm modifications

Hello,

we did a tenant migration and for some reason a lot of broker VM settings are still pointing to the old one.

We were wondering if it was possible to change the settings for it in bulk.

Thank you for your inputs.

Cortex XDR Get Incident API function 'hosts':None

I'm currently testing the api for Cortex XDR, in particular the 'get_all_incidents' function under '/public_api/v1/incidents/get_incidents' url.

Reference : https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Incidents

While test

XQL Incident Count Doesn’t Match UI Incident Count — Same Date Range

Hi everyone,

I’m working on a report using Cortex XQL to count incidents created between March 15 and March 31, 2025.

Here’s the query I’m using:

Cortex XDR Process Exclusions

We are deploying Cortex XDR to Windows servers initially in Report only mode and seeing memory Utiliziation on some servers ranging 500 MB- 1.2 GB. Is this considered to be normal?

Advise we receive was that we don't need to exclude ceritan process

Code signed executables

A colleague raised a query with regards code signing certificates?

For example if files are created, remodified and recompiled, the Sha256 will change every time, and these would need to be Whitelisted every time.

The question asked is if we are

custom scan with xdr agent for linux

Hi,

i would like to know if it's possible to do a custom scan for a specific file like we can with the cortex agent for windows but i would like to do it for linux.

I just see how to launch a global scan under linux but not a specific file.

Thanks

ERROR MESSAGE: This email is already registered with an account

Dear Team,
I recently created some users, but I made some mistakes with data entry, so I deleted 1 user, leaving me with 2 users to be deleted. I would like to recreate the deleted user with the right information. But I'm experiencing some issues with

Cortex XDR on Windows 10 LTSC

Hello,

We have not been able to install cortex XDR on a windows 10 LTSC machine. It starts to install but then fails. Is there a separate installation for Windows 10 LTSC machines?